The relationship between the EU–US Safe Harbor Program and the applicable law provisions set forth in the EU Data Protection Directive and the proposed EU Data Protection Regulation requires clarification.

A central concern for US companies is that the benefits of enrolment in the EU–US Safe Harbor Program will be undermined by the broad assertions of extraterritorial jurisdiction made by the EU pursuant to Article 4 of the Directive/Article 3 of the proposed Regulation.

If the extraterritorial scope of the Directive/Regulation is widely interpreted then many US companies may lose their incentive to join the Safe Harbor Program because the major benefits of joining the Safe Harbor Program—the ability to rely on industry dispute resolution mechanisms, US law to interpret the Principles, and US courts and administrative bodies to hear claims—will be removed.